quixos-nix-helpers/restricted-execution/worker.mjs

// Platform entrypoint, evaluated before loading the authored registry. A fresh
// Worker owns exactly one frame. The parent engine is reusable; BROKER's host
// token grants only this frame and expires before the next invocation.
const monotonic = performance.now.bind(performance);
const deny = () => {
  throw Error("RESTRICTED_AMBIENT_ACCESS");
};
const replace = (object, key, value) =>
  Object.defineProperty(object, key, { value, configurable: false, writable: false });
const NativeDate = Date;
const FixedDate = new Proxy(NativeDate, {
  construct(target, args) {
    if (!args.length) deny();
    return Reflect.construct(target, args, target);
  },
  apply() {
    deny();
  },
});
replace(NativeDate, "now", deny);
replace(NativeDate.prototype, "constructor", FixedDate);
replace(globalThis, "Date", FixedDate);
replace(Math, "random", deny);
// Identity/value codecs need deterministic SHA-256, never entropy or key creation.
const digest = crypto.subtle.digest.bind(crypto.subtle);
replace(globalThis, "crypto", Object.freeze({ subtle: Object.freeze({ digest }) }));
for (const name of ["performance", "Temporal", "scheduler", "WebSocket", "EventSource", "SharedArrayBuffer", "Atomics"])
  replace(globalThis, name, undefined);
for (const name of ["setTimeout", "setInterval", "fetch"]) replace(globalThis, name, deny);
// Intl's no-argument format defaults to the clock without consulting Date.now.
const format = Object.getOwnPropertyDescriptor(Intl.DateTimeFormat.prototype, "format").get;
Object.defineProperty(Intl.DateTimeFormat.prototype, "format", {
  configurable: false,
  get() {
    const bound = format.call(this);
    return (value) => {
      if (value === undefined) deny();
      return bound(value);
    };
  },
});
const formatToParts = Intl.DateTimeFormat.prototype.formatToParts;
replace(Intl.DateTimeFormat.prototype, "formatToParts", function (value) {
  if (value === undefined) deny();
  return formatToParts.call(this, value);
});
let used = false;
export default {
  async fetch(request, env) {
    if (used) return new Response("FRAME_EXPIRED", { status: 409 });
    used = true;
    const input = await request.json();
    const loading = monotonic();
    const source = await import("./package.mjs");
    const initializationMs = monotonic() - loading;
    const registry = source[env.CONFIG.registryExport];
    if (
      !registry ||
      typeof registry.invoke !== "function" ||
      JSON.stringify(registry.exports) !== JSON.stringify(env.CONFIG.exports)
    )
      throw Error("RESTRICTED_REGISTRY_MISMATCH");
    let open = true;
    const channel = async (value) => {
      if (!open) throw Error("EXPIRED_CONTEXT");
      const response = await env.BROKER.fetch("http://frame/port/" + env.CONFIG.frameToken, {
        method: "POST",
        body: JSON.stringify(value),
      });
      const result = await response.json();
      if (!open) throw Error("EXPIRED_CONTEXT");
      if (result.status !== "returned")
        throw Object.assign(Error(result.error?.message ?? "Port failed"), {
          code: result.error?.code ?? "PORT_FAILED",
        });
      return result.output;
    };
    const running = monotonic();
    try {
      const output = await registry.invoke(
        { exportId: input.exportId, workspace: input.workspace, receiver: input.receiver, input: input.input },
        channel,
      );
      const body = JSON.stringify({ status: "returned", output });
      if (new TextEncoder().encode(body).length > env.CONFIG.maxBytes) throw Error("RESTRICTED_OUTPUT_LIMIT");
      return new Response(body, {
        headers: {
          "content-type": "application/json",
          "x-quixos-initialization-ms": String(initializationMs),
          "x-quixos-execution-ms": String(monotonic() - running),
        },
      });
    } catch (error) {
      // Only authored/codec rejection codes cross the engine boundary. Engine
      // diagnostics stay private to the supervisor, never become protocol data.
      const code =
        typeof error?.code === "string" && /^[A-Z0-9_]{1,128}$/.test(error.code)
          ? error.code
          : "RESTRICTED_PACKAGE_FAILED";
      return Response.json({ status: "failed", error: { code, message: code } });
    } finally {
      open = false;
    }
  },
};